220a5c3dc610276e7500a328eaf0de02d0a4f7c565a007d378cbe4a0e47359bf

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
08-12-2024 15:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d7a4a60ffe2f2977d906e505e5eb703d_JaffaCakes118.pdf
Size

84KB
MD5

d7a4a60ffe2f2977d906e505e5eb703d
SHA1

d9788c04def750b1506ad4c4e71b0783a216bfac
SHA256

220a5c3dc610276e7500a328eaf0de02d0a4f7c565a007d378cbe4a0e47359bf
SHA512

5094e7766761a5fce94f69ef86efd4d3a48f04105bd9b06d817e495dba380f7544311dd9936366b74656e44f764838673ab5b4890bf5236ac4495e2c9e3d87de
SSDEEP

1536:IzyqVbjWWfLnxVG9kLDQWUAVZPyQIx0PW6pOu2z8+PWuW77UGVG54:HqVnWW+9FDAjzIxTu23Q77UGf

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2632	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2632	AcroRd32.exe
2632	AcroRd32.exe
2632	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\d7a4a60ffe2f2977d906e505e5eb703d_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2632

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
91f4ca352cc70f09d3250eb99019ff29

SHA1
548dd663b67ba7e03d8d7a76b86a239c9a3f69ac

SHA256
9e6b2c5d80bac907712091c67a5748f5edf7c01f1c8ba8d9c2d41c35aab728ec

SHA512
c1ba4bb562a1b075ed1b980a0dca2463be3fc44f8af8161c44db3640df237bec6e3774087f775fc1f1c2324d63285b304920a178190488e7bf6428a7333f8672

Download Submit